The pilot reported that, shortly after take-off and after selecting the landing gear up, the landing gear lights, and the panel lighting dimmed and then extinguished. On checking the alternator output he found that there was no electrical power and began emergency procedures. Unable to restore electrical power, the pilot attempted to lower the landing gear using the emergency system. However, the emergency system jammed before the landing gear could be fully lowered. He subsequently landed the aircraft with the landing gear retracted.

Examination of the aircraft found that the landing gear had been fully retracted on landing. Both the normal and emergency gear systems functioned correctly when tested. The electrical system failure was caused by inadequate output from the alternators, and battery discharge. The right alternator drive belt tension bracket had broken, and the drive belt had fallen off. The left alternator was able to produce only 5 A due to a shorted diode. Battery discharge soon after take-off suggests that these faults may have occurred during the previous flight.

An electrical charging fault had been reported on 30 December 1993. The maintenance organisation responsible for the aircraft had cleared the fault on 31 December 1993 with an entry indicating that both alternator drive belts had been tensioned and the operation of the alternators had been checked.

Unrestrained freight in the cabin of the aircraft was packed to the level of the cabin windows and was abutting the rear of the front seats. This would have limited the pilot's access to the emergency gear operating handle.

The pilot reported that the aircraft suffered a gradual reduction in power after take-off. The aircraft was force landed onto a railway line and suffered major damage. Subsequent investigation disclosed no apparent fault with the engine. The VW conversion fitted to this aircraft is prone to carburettor icing. The aircraft was operating on mogas which has a very low tolerance to carburettor ice.

Significant Factors

The following factors were considered relevant to the development of the accident:

1. The engine suffered a gradual power reduction.

2. The pilot was forced to land on unsuitable terrain

The flight was planned as a fire spotting flight. All systems were normal during the pre-flight, start and after start checks. The aircraft took off towards the east. The wind was reported as blowing from a southerly direction at approximately 10 knots. Witnesses reported that, after liftoff, the aircraft climbed at a very steep angle and very slow airspeed to approximately 300 feet above ground level. At that point the aircraft entered a flat spin to the left and completed four turns prior to impact 110 metres to the left of the runway centreline and 300 metres from the start of the take-off role. The engine ran at a high-power setting throughout the flight.

A post-accident inspection of the wreckage did not disclose any aircraft failure that might have contributed to the accident. The inspection did determine that the aircraft was not fitted with an aural stall warning device, similar to those fitted to all the other PA18 aircraft used by the Operator.

A row of trees, designed to act as a wind break, is located along the southern side of the flight strip. These trees may cause some turbulence when a southerly wind is blowing.

The pilot advised that he was concerned about possible turbulence from the trees and the crosswind effect on the aircraft. As a result, he attempted to climb the aircraft above the trees as soon as possible after liftoff. During the climb the pilot was distracted by the aircraft's proximity to the trees, and he did not monitor the airspeed closely. He allowed the airspeed to reduce and at approximately 300 feet above ground level the aircraft stalled and entered a flat spin to the left.

The pilot had no warning of the stall. There was no pre-stall buffet, and the aircraft was not fitted with an aural stall warning device.

The pilot attempted to recover from the stall, but the aircraft impacted the ground before his attempt had any effect.

It is possible that had an aural stall warning been fitted to the aircraft it would have alerted the pilot in sufficient time to prevent the loss of control.

Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

On 15 October 2014, the ATSB commenced an investigation into a reported vertical speed exceedance involving an Embraer ERJ 190, VH-ZPN, near Hobart Airport, Tasmania on 1 October 2014.

Examination of the information collected during the investigation indicated that the aircraft did not exceed the allowable vertical speed and that the event did not constitute a Transport Safety Matter under the Transport Safety Investigation Act 2003.

On that basis, the ATSB has decided to discontinue the investigation.

What happened

On the afternoon of 14 October 2014, the pilot/owner of an amateur-built Van’s Aircraft Inc. RV-6A aircraft, registered VH-JON and operated in the ‘experimental’ category, departed Moorabbin Airport, Victoria on a local flight.

Shortly after reaching a cruise altitude of 2,900 ft, the aircraft descended to 2,500 ft. After that time, no further air traffic control radar returns were received from the aircraft. The aircraft descended rapidly and a witness reported observing objects falling from the aircraft. The aircraft subsequently collided with the ground next to a house in the suburb of Chelsea, 8 km south of Moorabbin. The pilot was fatally injured, and the aircraft was destroyed.

Following the accident, members of the public found a number of aviation-related items away from the accident site that belonged to the pilot.

What the ATSB found

The liberation of the items from the aircraft’s interior indicated that the canopy likely opened in‑flight. However, this was based on the assumption that the items were initially inside the cabin.

Examination of the primary and secondary canopy locks found varying degrees of damage and one component was missing. Therefore, the state of the locking mechanisms prior to the impact could not be established.

It was possible that the pilot was startled and distracted after the canopy opened due to the severe cockpit wind, noise and debris flying about. Though, the extent to which this contributed to the occurrence was unknown.

Also, while the ATSB was unable to determine how the canopy opening would have affected aircraft control, there were indications that the pilot was attempting to respond to the situation. However, for reasons undetermined, recovery did not occur.

Finally, the ATSB identified a safety issue regarding the potential for the in‑flight opening of a tip‑up, forward-hinged canopy to result in a significant pitch down tendency in a number of Van’s Aircraft Inc. models that may affect aircraft control.

What’s been done as a result

Van’s Aircraft Inc. developed a service letter for distribution to builders and operators highlighting the varying consequences of a canopy opening in-flight, in particular, involving a tip-up canopy. The letter recommends inspecting the canopy locking mechanism to confirm that it operates as designed and to ensure the mechanism fully engages when closed, and highlights the need to secure the secondary latch at the top-rear of the canopy in the RV-6/7/9 design prior to take-off.

Additionally, the ATSB has issued a safety advisory notice to all owners of Van’s aircraft to highlight the findings of this investigation.

Safety message

This accident and other reported experiences highlight the varying consequences when a canopy opens in-flight from no effect to a sudden pitch down. The result can vary from being relatively benign to significant, but pilots could expect an element of startle and distraction. Additionally, the ATSB reminds pilots to check the security of the canopy prior to take-off.

Amateur-built Van’s Aircraft RV-6A aircraft, registered VH-JON

Safety analysis

Introduction

Shortly after reaching 2,900 ft, Vans Aircraft Inc. RV-6, registered VH-JON (JON), descended rapidly and collided with the ground next to a house. The pilot was fatally injured, and the aircraft was destroyed. Following the accident, members of the public found a number of aviation-related items belonging to the pilot at distances of up to 3 km north of the accident site.

The recorded engine data showed that the engine was operating normally prior to the impact. This was consistent with the engine examination, which identified no internal mechanical failure or abnormality that would have precluded normal operation. In addition, the integrity of the aircraft structure and the flight controls was also established.

This analysis will examine why the aircraft’s canopy likely opened in flight, how this may have occurred and the possible consequences for continued safe flight.

Canopy opening in flight

Timing of the canopy opening

A witness reported observing items falling from the aircraft during the aircraft’s descent. This was consistent with the location of some of the pilot’s belongings found external to the aircraft and away (up-track) from the accident site. With no other place for the items to exit the cockpit, the liberation of the items from the aircraft’s interior indicated that the canopy likely opened in flight. While based on the assumption that the items were initially inside the cockpit, this conclusion was similar to that by the United States National Transportation Safety Board’s (NTSB) investigation into an RV‑6 accident on 20 June 2014 (see NTSB report CEN14FA306).

The ATSB considered the possibility that the pilot’s flight bag containing the items was inadvertently left on the aircraft’s wing during the departure from Moorabbin Airport. However, as the bag would most likely slide off the wing during the take‑off, this was the least probable scenario.

The ATSB also examined the possibility that the pilot deliberately opened the canopy for a particular reason such as experiencing smoke, fire or fumes in the cockpit. While there was insufficient evidence to support this scenario one way or the other, given the results of the pilot’s post‑mortem, it was deemed unlikely.

Canopy locking mechanism

Damage to the primary locking lever mechanism suggested that it was initially closed but forced open during the impact. However, anecdotal reports from RV-6 pilots indicated that, under some circumstances, it was possible for the canopy in these aircraft to open when the lever was in the closed position. Furthermore, the ATSB could not discount that the pilot of JON may have manipulated the lever in attempt to lock the canopy during the descent.

There was no damage to the two hooks and their respective receptacles at the rear of the canopy whereas, if engaged at the time of impact, some level of damage to these components would be expected. While it was possible that the primary lock was open prior to the impact, the aircraft sustained significant damage, which may have affected the state of the mechanism. Also, the locking catch and spring were not found and could not be examined.

The secondary lock was found in the unlocked position and showed no signs of damage. However, as this lock is readily moved by turning the associated handle, it could not be discounted that it moved on impact. Also, it was possible that the lock was initially closed prior to take-off and worked its way open during the flight.

In summary, there was insufficient evidence to establish if either of the locking mechanisms remained unlocked since prior to take-off, or if they failed in flight.

Consequences of an open canopy

Startle and distraction

The United States Federal Aviation Administration (Advisory Circular 120-111) recognised that:

Because upsets that occur in normal flight operations are unplanned and inadvertent, pilots may be startled or surprised, adversely impacting recognition or recovery.

Martin and others (2012) also stated that, if pilots were not expecting things to go wrong, the level of startle or surprise they experience could be significant and may last between 0.3 and 1.5 seconds. The rapid capture of attention due to a startling event can distract a pilot from the primary task of flying.

The NTSB investigation report into the fatal RV-6 accident in the United States on 20 June 2014 recognised that there may be a tendency for pilots to experience ‘shock and chaos’ with an open canopy due to the severe cockpit wind, noise and debris flying about. This was similar to reports from a number of RV-6 pilots who cited lots of wind noise and distraction when their canopy opened in flight. Van’s also indicated that an open canopy could be distracting.

The recorded engine data showed that, about 7 seconds after the oil pressure began to fluctuate, the pilot reduced the engine power to idle. This was slightly above the typical reaction time of 4‑6 seconds for pilots responding to an emergency situation.^[8] However, it was unknown if the pilot conducted any other actions prior to this time.

The ATSB concluded that it was possible that the pilot of JON was startled and distracted after the canopy opened. The extent to which this contributed to the occurrence could not be established.

Aircraft control

Reports from a number of RV-6 pilots who had experienced an in-flight opening of a tip-up canopy showed varying results. Some reported no consequences while others experienced a sudden pitch down. In these cases, the aircraft was reported to remain controllable. In contrast, the NTSB concluded that the likely in-flight opening of an RV-6 canopy resulted in a loss of pitch control and collision with terrain. Similarly, the pilot of an RV‑12 reported experiencing a pitch down after their aircraft’s canopy opened in flight to the full vertical position shortly after take-off. That pilot also reported that there was no response from the elevator or rudder after the canopy opened.

Van’s advised that an in-flight canopy opening would generally not cause any problems. However, while not tested, they theorised that a forward pitching moment may occur at higher airspeeds due to a disruption in the airflow over the aircraft’s horizontal stabiliser. Given the variability in consequences reported, and without flight testing, the ATSB was unable to establish how the canopy opening on JON would affect its controllability, and if this directly resulted in the loss of control. Nonetheless, other reported experiences after an in-flight canopy opening suggest that, under some circumstances, in-flight opening of the tip-up canopy on some Van’s aircraft can result in a sudden pitch down with related controllability issues.

The reduction by the pilot of engine power to idle and witness observations of the aircraft banking and the wings then coming level, suggest that the pilot was attempting to respond to the in-flight canopy opening. However, for reasons undetermined, the pilot was unable to recover the situation before impacting terrain.

Summary

While the ATSB was unable to establish how the canopy likely opened, this accident and other reported in-flight canopy openings in a number of Van’s aircraft models highlight the varying consequences when such occurrences take place. The result can vary from being relatively benign to significant, but pilots can expect an element of startle and distraction. Additionally, such occurrences serve as a reminder for pilots to check the security of their aircraft’s canopy prior to take‑off. Of note, Van’s advised the ATSB that the RV‑12 and RV‑14 models now have a ‘canopy open’ warning switch incorporated into the kit design. Other pilots who have experienced an in‑flight canopy opening have included an additional checklist item to confirm the canopy was locked before departing.

__________

8. In 1999, the United Kingdom Civil Aviation Authority commissioned a simulator-based study into helicopter pilot reaction times in response to an emergency. The study determined that the mean total reaction time (time taken to detect and respond) generally ranged between 2–4 seconds, with 4–6 seconds typical of a longer but acceptable reaction time.

The occurrence

On the afternoon of 14 October 2014, the pilot/owner of an amateur-built Van’s Aircraft Inc. (Van’s) RV-6A aircraft, registered VH-JON (JON) and operated in the ‘experimental’ category, departed Moorabbin Airport, Victoria on a local flight.

The aircraft departed at about 1323 Eastern Daylight-saving time^[1] and was identified on Airservices Australia surveillance radar tracking southbound toward the coast. The wind conditions at the time were 17 kt from the south‑south‑east. At about 1325, the aircraft reached an altitude of 2,900 ft. Shortly after, at 1326, the aircraft descended to 2,500 ft. After that time, no further radar returns were received from the aircraft.

A witness reported observing the aircraft banking and seeing objects falling, like ‘packages’ were being ‘dropped’. The aircraft’s wings then became level. Another witness also reported sighting the aircraft banking and then becoming level. Both reported that the aircraft was descending rapidly. The aircraft subsequently collided with the ground in a laneway next to a house in the suburb of Chelsea, 8 km south of Moorabbin (Figure 1).

The pilot was fatally injured, and the aircraft was destroyed. A number of small post-impact fires were extinguished and a number of houses and cars sustained damage.

Members of the public reported finding a number of aviation-related items belonging to the pilot. These items were recovered at distances of up to 3 km north of the accident site.

Examination of the recorded air traffic control radio frequencies revealed no emergency broadcast from the pilot.

Figure 1: Accident site from the initial impact point on the left, looking south down the laneway

__________

1. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Potential adverse effects of a tip-up canopy opening in-flight

In‑flight opening of the tip-up canopy in a number of Van’s Aircraft Inc. models has resulted in varying consequences, including a significant pitch down tendency, increasing the risk of a loss of control.

Aviation Safety Issue: AO-2014-164-SI-01

Aviation Safety Action: AO-2014-164-SAN-012

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving an amateur-built Van’s RV-6A, registered VH-JON, which occurred 8 km south of Moorabbin Airport, Victoria on 14 October 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Shortly after levelling off in the cruise, the tip-up canopy in VH-JON likely opened, resulting in a loss of control from which the pilot was unable to recover before impacting terrain.

Other factors that increased risk

• In‑flight opening of the tip-up canopy in a number of Van’s Aircraft Inc. models has resulted in varying consequences, including a significant pitch down tendency, increasing the risk of a loss of control. [Safety issue]

Other findings

• The reason for the canopy opening in VH-JON could not be determined.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• a number of witnesses
• Van’s Aircraft Inc.
• the Van’s Airforce Forum
• Airservices Australia
• the Civil Aviation Safety Authority
• Victoria Police.

References

Federal Aviation Administration 2004, Airplane Flying Handbook, United States Department of Transportation.

Federal Aviation Administration 2015, Upset Prevention and Recovery Training (Advisory Circular 120-111), United States Department of Transportation.

Flight Safety Foundation 1999, ‘Simulator-based study of emergencies yields insights into pilots’ reaction times’, Helicopter Safety, March-April 1999, vol. 25, no. 2.

Martin, WL, Murray, PS & Bates, PR 2012, The Effects of Startle on Pilots During Critical Events: A Case Study Analysis, Brisbane, Griffith University.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Van’s Aircraft Inc., the Civil Aviation Safety Authority and the United States National Transportation Safety Board.

A submission was received from Van’s Aircraft Inc. The submission was reviewed and where considered appropriate, the text of the report was amended accordingly.

Context

Pilot information

The pilot held a Private Pilot (Aeroplane) Licence that was issued on 24 September 1985.^[2] As at 2 October 2014, the pilot had a total flying experience of 1,659 hours.

The pilot held a valid Class 2 Aviation Medical Certificate and was required to wear distance vision correction and have vision correction available for reading. The pilot was reported to have been well rested and in good health prior to the accident.

The pilot’s post-mortem examination found amyloid deposition^[3] in the heart, which was often considered age‑related. However, the role of this and any other natural disease in the development of the occurrence could not be established. Furthermore, there was no evidence to suggest that fumes, smoke, or fire had affected the pilot prior to the impact. The pilot’s clothing did not show any obvious evidence of grease or foreign materials such as bird feathers from a birdstrike.

Aircraft information

The Van’s Aircraft Inc. (Van’s) RV-6A is a kit-built aircraft with a low-wing and fixed undercarriage. VH-JON (JON) was constructed by the pilot and registered with the Civil Aviation Safety Authority on 4 July 2003 (Figure 2). A review of the aircraft’s logbook and other related documentation indicated that JON was maintained in accordance with an approved Civil Aviation Safety Authority maintenance schedule. The last periodic inspection was conducted on 1 July 2014, at which time the total time in service was about 338 hours for the airframe and 201 hours for the engine. The last oil change occurred on 30 September 2014. At the time of the occurrence, all of the required maintenance had been completed and there were no defects recorded.

Figure 2: JON showing the tip-up canopy in the open position

Tip-up canopy

Although the Van’s RV-6 could be installed with aft- and forward-hinged canopies, JON was fitted with a forward-hinged ‘tip-up’ canopy (Figure 2), which had two locking mechanisms. The primary locking mechanism was operated by a locking lever located on the left side of the fuselage, adjacent to the pilot’s seat. When placed into the locked position, a connecting rod from the lever latched two hooks into corresponding receptacles in the two rear corners of the canopy. The lever was then locked by a spring-loaded locking catch (Figure 3 and Figure 4).

Figure 3: Van’s Aircraft Inc. diagram showing the primary canopy locking mechanism from the top view in the locked position (labelled in red). The locking lever in JON is shown in the photograph at inset

Source: Van’s Aircraft Inc. and supplied, both modified by the ATSB

The secondary mechanism was a handle attached to the centre of the canopy frame, which was also used to assist with closing (Figure 4). Once closed, the handle was turned 90° so that a tang on the end of the handle extended under the adjacent fuselage frame. This provided redundancy in the event the main locking mechanism malfunctioned.

Figure 4: Van’s Aircraft Inc. diagram from the side view showing the primary and secondary locking mechanisms. The secondary lock attached to JON is shown in the photograph at inset

Source: Van’s Aircraft Inc. and supplied, both modified by the ATSB

Previous occurrences involving JON

A search of the ATSB’s occurrence database revealed that JON was involved in two previous landing accidents. One in 2007 and in 2010. On both occasions, the engine was replaced, the damage repaired and the aircraft returned to flying status.

The aircraft was also involved in an incident about 1 month prior to the October 2014 accident. It was reported that a minor engine fire occurred on the ground at Moorabbin due to over priming the engine for a ‘hot start’.^[4] The fire was extinguished with the assistance of ground personnel. The pilot reportedly conducted an inspection of the engine and associated area, with nil damage found. Several flights were conducted since that time and it could not be established if the fire contributed to the occurrence south of Moorabbin Airport on 14 October 2014.

Recorded information

The aircraft was fitted with two Garmin global positioning system (GPS) units, a Dynon EMS‑D120 engine monitoring system and a Dynon EFIS-D100 electronic flight information system. The aircraft’s track on the day was recovered from recorded data from one of the GPS units and was consistent with the Airservices Australia surveillance radar track (Figure 5).

The Dynon D100 system did not provide any recorded data, but the D120 system recorded a number of engine parameters and the fuel level in each wing. The data was downloaded by the ATSB and captured the accident flight up until 1326:09, several seconds before the impact with terrain. Specifically, the data showed:

• Up until 1325:52, the engine data appeared stable and the oil pressure remained normal at around 75 pound per square inch (psi). After this, the pressure fluctuated to as low as 34 psi (Figure 5). By the last second of the recorded data, the pressure increased to 72 psi. The fluctuations likely resulted from a sudden change in aircraft attitude temporarily disrupting the oil supply in the oil sump.
• An analysis of the recorded fuel levels indicated that, at around the same time the oil pressure began to fluctuate, the fuel levels diverged at a rate higher than previously recorded. This was possibly due to an abrupt roll^[5] to the left or acceleration in yaw.^[6]
• Until 1326:00, the propeller revolutions per minute (RPM) was relatively constant at 2,405 RPM. Immediately after, it reduced for 1 second and then increased to 3,069 RPM over the next 3 seconds. From 1326:05 until the recording ceased, the RPM stabilised, indicating that the propeller governor was functioning as required. The variation in RPM was also likely the result of a change in the aircraft's attitude.
• At 1326:00, the engine manifold pressure was recorded as 26.625 inches Hg. After this, it reduced to as low as 4.6875 inches Hg. This coincided with a reduction in fuel pressure and was representative of the pilot reducing the engine power to idle (Figure 5).
• The exhaust gas temperatures were stable, but decreased with the reduction in manifold pressure, which would be expected.

Figure 5: Downloaded GPS track, and the position of the first oil pressure fluctuation and reduction in engine manifold pressure

Wreckage and impact information

Examination of the wreckage found that the aircraft initially impacted a house fence at a descent angle of about 35° and slightly left wing down. Images recovered from a nearby closed‑circuit television camera showed the last seconds of the flight and confirmed a steep nose-down flight path (Figure 6). The ATSB estimated that, based on the video footage, the aircraft’s speed at that time was about 200 kt (370 km/h).

Figure 6: Composite image of the aircraft’s descent. The image was developed from sequential video frames to show the aircraft’s descent and was used to estimate the aircraft’s speed within a 1‑second timeframe

The left wing and top section of the canopy remained at the initial impact point and the remainder of the aircraft continued along the laneway. The propeller, engine, and tail surface also separated from the remainder of the wreckage and were located along the wreckage trail. The right wing and fuselage came to rest about 90 m from the initial impact point. Items associated with the aircraft were located in the laneway up to 130 m away.

A number of fires occurred along the wreckage trail. A number of small, localised fires on the engine were captured by the closed-circuit television footage. The wreckage examination also:

• Identified all flight controls and major aircraft components and established control continuity. The aircraft damage was consistent with the impact.
• Identified parts of the aircraft’s canopy at the beginning and along the wreckage trail. The secondary canopy locking mechanism was found in the unlocked position.
• Found evidence of propeller rotation.
• Established that the engine oil hoses and oil filler cap/dipstick were secure, though the dipstick housing had fractured from the impact. Oil was observed over the engine, consistent with impact damage to the crankshaft.
• Found that all fuel hoses were secure; however, a localised area of burning was observed on the fuel hose. The firewall and in-cockpit soundproofing foam also showed evidence of burning.
• Established that the exhaust muffler, air filter and induction system were clear of debris or restriction.
• Established continuity of the engine and propeller cockpit controls.
• Found an oil coating on some sections of the aircraft, including the tail, right wing, fuselage and canopy Perspex. This was likely due to the significant disruption to the aircraft.

The engine was recovered from the wreckage and transported to an approved overhaul facility for detailed inspection under the supervision of the ATSB. The ATSB also conducted further examinations of the engine fuel hose, the engine firewall and part of the canopy locking mechanism at the ATSB’s technical facilities in Canberra, Australian Capital Territory.

Recovered items

A number of aviation-related items were found by members of the public at distances up to 3 km north of the accident site (Figure 7). These items included the pilot’s Civil Aviation Safety Authority flight crew licence and aviation medical certificate, an aircraft pitot tube cover and warning flag, a flight bag, an En Route Supplement Australia and a very high frequency handheld transceiver and antenna. None of these items displayed evidence of fire damage.

Figure 7: Location of recovered aviation-related items relative to the accident site

Test and research

Engine examination

The engine examination found no evidence of internal mechanical failure that would have prevented normal operation prior to the occurrence. Any damage observed was consistent with impact forces.

Fuel hose and engine firewall

Examination of the fuel hose determined that the localised scorching and sooting was limited to the outer fire sleeve. The inner steel braiding and hose showed no evidence of heat or fire damage. A very small breach was observed in the inner hose; however, its position suggested that this was caused by deformation of the hose from impact forces.

Heat testing of a piece of undamaged firewall and in-cockpit soundproofing foam showed that, if a fire was present in the engine bay near the firewall, some smoking could be expected in the cockpit. However, the results of the heat testing indicated that the extent of the fire damage was more likely from the post‑impact fire.

Canopy locking mechanism

An inspection of the canopy locking mechanism found that the secondary lock was in the unlocked position. There was no evidence to indicate that the lock was forced open.

The primary locking lever was found in the unlocked position, however, the surrounding airframe structure was damaged and deformed. The locking catch and spring were not located, but the corresponding bolt was in place. The two hooks and hook receptacles on the rear corners of the canopy were not damaged or deformed.

Examination of the primary locking lever found that (Figure 8):

• The damage and deformation of the lever suggested that it was initially closed, but was forced out of its housing into a partially-open position at some point during the impact sequence.
• While the locking catch and spring were not found, the attaching bolt was intact. It could not be determined whether the catch fractured during the impact sequence or was not previously in position.
• The locking lever connecting rod fractured in overstress, likely due to the impact. It could not be determined whether those impact forces caused the lever to open.

Figure 8: Primary locking lever, normal location of the missing locking catch and spring, and the fractured connecting rod

Related occurrences

ATSB occurrence database

A review of the ATSB’s aviation occurrence database identified a range of reports where an aircraft’s canopy opened in flight. None of these reports involved the RV‑6/6A, RV‑7/7A or RV‑9/9A model aircraft.

Overseas investigations

On 20 June 2014, a Brumwell (Van’s) RV-6 aircraft impacted a house in the United States after departure from cruise flight. A witness reported observing a jet aircraft flying east and a small aircraft flying north. The small aircraft’s wings then started ‘rocking back and forth’ before the ‘nose went down’. That witness also reported seeing two objects come from the aircraft. The objects were later found near the accident site. The effects of wake turbulence from the jet aircraft, if any, could not be determined. However, the United States National Transportation Safety Board determined that the exit of the objects from the aircraft’s interior indicated that the canopy likely opened in-flight, which led to a loss of pitch control. The safety board was unable to establish the reason for the canopy opening due to fire damage (NTSB report CEN14FA306).

The pilot of an RV-12 aircraft reported that, as the aircraft became airborne, the tip-up canopy opened to about 3 inches (7.6 cm). The pilot reported grasping the canopy and simultaneously lowering the nose of the aircraft and partially reducing engine power in an attempt to land on the remaining runway. As the aircraft pitched down, the pilot lost grip of the canopy and it opened to the full vertical position. This reportedly caused the nose of the aircraft to pitch over further and, when the pilot applied back pressure on the control stick, there was no response from the elevator. The pilot also reported that there was no response from the rudder. The pilot was able to level the aircraft’s wings prior to landing hard. The pilot indicated that the canopy latch was hard to latch and they most likely did not secure it properly. Van’s commented on the accident, stating that they had not conducted any testing on the aerodynamic effects of the RV-12 canopy opening in flight. Therefore, they could not contest the pilot’s claims that the canopy opened to the full vertical position. Van’s indicated that they had a reasonable amount of field experience with tip‑up canopies opening in flight on the RV-6/6A, RV-7/7A, RV-9/9A models and other incidents involving the RV-12 where no loss of control was reported. They further stated that, while the extent that a canopy opens tends to vary with the aircraft’s airspeed, from their experience, the canopy typically opens to a point of aerodynamic equilibrium. At this point, the canopy’s position stabilises. This accident was the first reported where the aircraft’s pitch authority was affected by a tip-up canopy opening in flight on a Van’s aircraft (NTSB report CEN13LA340).

The pilot of an RV-12 aircraft did not secure the canopy latch after entering the cabin. After take‑off, the pilot noticed that the canopy was unsecured. The pilot became distracted with securing the canopy as the aircraft descended toward the runway. The aircraft collided with the runway as the pilot attempted to re-establish a level flight attitude. The pilot indicated that the accident could have been prevented had they focused on flying the aircraft instead of attempting to secure the unlatched canopy (NTSB report CEN11LA601).

Pilot forum reports

Anecdotal reports from a number of Van’s RV-6 pilots detailed varying consequences from an open canopy in flight. These included:

• An instance when the aircraft was in the cruise at 4,500 ft and about 155 kt. After several minutes, the pilot heard a loud noise or pop and determined that the canopy had opened. The pilot noted that the primary locking lever was in the locked position. The pilot reported that the aircraft ‘had a definite pitch down attitude’ but was controllable. The pilot reduced the airspeed to about 85–105 kt before closing and re-locking the canopy. The pilot could not recall if the secondary latch was locked, though this would normally be double-checked before take-off.
• A case where the pilot reported not double-checking the secondary latch prior to take-off, but indicated that the primary latch was locked. As the aircraft was climbed through 3,000 ft at 100 kt, the canopy opened. The aircraft was reported to instantly pitch 45°down with lots of wind noise in the cockpit. The pilot reduced power to idle and commenced arresting the descent. The pilot reported a 1,000 ft altitude loss. With the aircraft slowed to 60 kt, the two occupants closed the canopy. The pilot reported that, as a result of this occurrence, they included an additional checklist item to check that the canopy was locked.
• A report from one pilot that they intentionally flew an RV-6A and an RV-7A with the tip-up canopy open during flight testing. The pilot indicated nil effect on the aircraft’s handling, other than a high noise level. This pilot further suggested that, from testing, the canopy could be used in place of a non‑usable elevator. The pilot indicated that, once their aircraft was slowed and trimmed for level flight, pushing the canopy up caused the aircraft’s nose to lower and closing the canopy caused the nose to rise.
• A report of an RV-6A tip-up canopy that came open during cruise at 4,000–5,000 ft and 155‑170 kt. When the canopy opened it reportedly 'jerked the stick’ out of the pilot’s hand and the aircraft began a rapid descent. The pilot attempted to close the canopy but it did not move until the aircraft was under control and slowed down to near the stall^[7] speed. The aircraft was recovered after descending through several thousand feet.
• An instance where an RV-6 aircraft’s tip-canopy was reported to have opened twice during flight. The pilot reported that in the first incident they forgot to close and lock the canopy after leaving it open during taxi. During climb-out, the canopy gradually opened as the aircraft’s airspeed increased. The pilot reported slowing the aircraft and securing the canopy. On the second occasion, the aircraft was in a ‘dive’ at about 185 kt when the canopy suddenly opened ‘violently’ resulting in a pitch down. The canopy was reported to have lifted up before settling at a height of about 18 inches (45.7 cm). The pilot reduced the power to idle and arrested the descent until approaching the stall speed. With some effort, the pilot closed the canopy. After landing, the pilot determined that the secondary lock had been secured, but the primary mechanism had not been completely locked. The pilot felt that with in-flight vibrations, the primary mechanism released and that, due to the descent, the secondary latch had worked its way open.

Van’s comments

Van’s, the manufacturer of the aircraft kit advised that they were aware of incidents where the tip‑up canopy opened on RV-6 aircraft. They reported that this typically happened when the primary and/or secondary locking mechanisms were not engaged. Van’s also indicated that:

• While not normal, it may be possible for the primary locking mechanism to not engage completely if the aircraft was not built accurately.
• When the primary lock was not engaged or was ineffective due to build issues, the secondary lock may be sufficient to hold the canopy until the aircraft’s speed built up. As the aircraft’s speed built and the amount of suction on the canopy increased, there was the risk that the secondary lock would twist, allowing the canopy to open.
• The suction holding the canopy open could make it difficult for pilots to overcome.
• Generally, the canopy opening did not result in any control issues. The main risk was the pilot becoming distracted, particularly when close to the ground.
• Some pilots have reported a pitch down, while others have not.
• Theoretically, it is possible that at higher airspeeds, an open canopy may disrupt the airflow over the aircraft’s horizontal stabiliser. If this occurred, a forward pitching moment results. However, this had not been tested.

__________

2. The pilot also held a Commercial Pilot (Aeroplane) Licence, but because their Class 1 Aviation Medical Certificate was out-of-date, could not perform flying duties associated with this licence.
3. A disorder caused by deposits of an abnormal protein in the heart tissue.
4. A start, or attempted start of the engine after it had been recently run.
5. Term used to describe movement of an aircraft about its longitudinal axis.
6. Term used to describe movement of an aircraft about its vertical axis.
7. Term used when a wing is no longer producing enough lift to support an aircraft's weight.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 11 October 2014, GWA train 7MD3 departed Muckaty, NT for Berrimah Freight Terminal (Figure 1). Measuring 977 m in length, with a gross weight of 6924 t, the train was crewed by a driver and co-driver, and consisted of two locomotives, crew car and 78 wagons loaded with manganese ore.

Figure 1: NT rail network map

Source: Geoscience Australia annotated by ATSB.

At about 0100[1] on 12 October 2014, train 7MD3 passed through Katherine at a speed of 80 km/h. As the train passed over the Novis Quarry Road level crossing, the co-driver noticed a white car alongside the track. Soon after, the driver saw a white light being waved near the track further ahead and immediately applied full train brake.

About 6 seconds later, as train 7MD3 rounded a bend, the driver saw a green utility road vehicle in the middle of the track immediately before the Katherine River Bridge. The driver made an emergency application of the train brake and sounded the locomotive horn.

At about 0102, the lead locomotive of train 7MD3 struck the utility vehicle at a speed of about 70 km/h. The train crew believed that the impact had derailed the locomotive and they were about to fall off the bridge and into the Katherine River. While the road vehicle became lodged under the lead bogie, the locomotive and the trailing wagons remained on track. The train travelled approximately 500 m further (Figure 2) before finally coming to rest atop a culvert bridge, with the damaged vehicle hanging precariously over the right side of the bridge (Figure 3).

Figure 2: Collision and resting point

The co-driver contacted Train Control and reported the collision while the driver went to the crew car to ensure the wellbeing of the other train crew before all three returned to the lead locomotive. One of the crew inspected the road vehicle and ascertained that no one was trapped inside.

Northern Territory Police officers attended the scene and provided assistance to all four crew members. Neither the driver of the vehicle nor any of the train crew was injured in the collision, although one member of the train crew was taken to hospital as a precautionary measure. All crew members were relieved from duty.

Figure 3: Vehicle position post collision

Train 7MD3 remained in situ while GWA personnel inspected the site and ensured the safety of the train and the track infrastructure. During the subsequent day, the train was moved back off the bridge and the remains of the vehicle extracted from under the locomotive bogie. At 1450 on 12 October 2014, Train 7MD3 recommenced its journey and continued to Berrimah Freight Terminal with a new train crew.

The driver of the vehicle was interviewed by the Northern Territory Police. During the interview, the driver informed the interviewing officers that he had been attempting to traverse the track just west of town when his car became stuck. Upon realising the approach of a train he had attempted to warn the train by flashing a torch.

ATSB comment

The point where the road vehicle attempted to traverse the railway did not contain any structure that resembled a level crossing, or any other provisions for road vehicles to safely cross the track. Evidence showed that in the attempt to traverse the rail line, the driver entered the rail corridor and mounted the east side of a steep embankment topped by the ballast formation supporting the rail track. The vehicle’s front wheels subsequently ‘hung’ on the east rail, such that its chassis rested on the track ballast and embankment with the rear wheels only lightly contacting the ground and unable to provide sufficient tractive effort.

There were a number of vehicle level crossings and road overpasses near Katherine, the closest being Novis Quarry Road, less than 1 km from where the road vehicle attempted to traverse the track.

While there is risk of injury or death to road vehicle occupants in the event of a collision with a train, there is also a very serious risk of injury or death to train crew and passengers in the likely event the train subsequently derails. At this location, derailment could have resulted in a train (freight or passenger) falling many metres into the Katherine River.

Safety message

This occurrence highlights the very significant risk of injury, death and serious damage that is associated with road vehicle operators attempting to cross railway tracks in areas other than designated level crossings. Risks are not confined to the road vehicle and occupants – there is also a high likelihood of train derailment after any track collision, with significant associated risks to the train crew, passengers, freight and infrastructure.

• Read more about ATSB's SafetyWatch: Safe work on rail

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 16 October 2014, the pilot of a Cessna 206 aircraft, registered VH-KRR, conducted a solo training flight from Bankstown to Cootamundra, New South Wales and return. At about 0800 Australian Eastern Daylight Time, the aircraft departed Bankstown Airport with full fuel and landed at Cootamundra Airport at about 0943.

After taxiing to the parking bay and shutting down the engine, the pilot dipped the fuel tanks. He reported that 100 litres remained in the right tank and 85 litres in the left. This indicated an actual fuel consumption rate of about 67-70 litres/hour, and about 12 litres less fuel remaining in the tanks than the pilot had expected.

At about 1022, the aircraft departed Cootamundra on a planned track to Bankstown via Rugby and Bindook. At about 1100, the pilot observed that the aircraft had deviated from the planned track and attempted to track direct to Bindook, however took up a heading of about 120°, which resulted in a further deviation from the planned track.

At about 1114, and at 5,500 feet above ground level, the aircraft’s engine surged and then stopped. The pilot conducted some emergency checks and sighted a suitable landing area. The aircraft collided with trees about 50 metres short of the intended landing site and was substantially damaged. The pilot sustained a minor injury.

The aircraft owners attended the accident site and reported that about 7 litres of fuel (unusable) remained in the right tank and none in the left. This incident highlights the importance of thorough pre-flight planning and monitoring and reassessing actual versus planned flight tracks and aircraft fuel consumption.

Aviation Short Investigations Bulletin - Issue 38

What happened

On 1 August 2014 a Qantas Airways Ltd. (Qantas) Boeing 737-838 aircraft (registered VH-VZR and operated as QF842) commenced take-off from Sydney Airport, New South Wales. The flight was a scheduled passenger service from Sydney to Darwin, Northern Territory.

While the aircraft was climbing to cruise level, a cabin crew member reported hearing a ‘squeak’ during rotation. Suspecting a tail strike, the flight crew conducted the tail strike checklist and contacted the operator’s maintenance support. With no indication of a tail strike, they continued to Darwin and landed normally.

After landing, the captain noticed some paint was scraped off the protective tailskid. This indicated the aircraft’s tail only just contacted the ground during take-off.

What the ATSB found

The ATSB found the tail strike was the result of two independent and inadvertent data entry errors in calculating the take-off performance data. As a result, the take-off weight used was 10 tonne lower than the actual weight. This resulted in the take-off speeds and engine thrust setting calculated and used for the take-off being too low. As a result, when the aircraft was rotated, it overpitched and contacted the runway.

The ATSB also identified that the Qantas procedure for conducting a check of the Vref40 speed could be misinterpreted. This negated the effectiveness of that check as a defence for identifying data entry errors.

What's been done as a result

Qantas has advised that, in response to this occurrence, the Central Display Unit pre-flight procedure has been modified. This modification requires that, after the take-off data has been compared/verified by both flight crew, they are to check the ‘APPROACH REF’ page and verify the Vref40 speed.

In addition, Qantas also advised that the Flight Crew Operating Manual was amended to include a check that the take-off weight in the flight management computer matched that from the final load sheet. This check was also to ensure the take-off weight from the final load sheet was not greater than that used for calculating the take-off performance data.

Safety message

Data input errors can occur irrespective of pilot experience, operator, aircraft type, location or take-off performance calculation method.

Effective management and systems can significantly reduce the risk of data input errors. Good communication and independent cross-checks between pilots, effective operating procedures, improved aircraft automation systems and software design, and clear and complete flight documentation will all help prevent or uncover data entry errors.

The application of correct operating data is a foundational and critical element of flight safety, but errors in the calculation, entry and checking of data are not uncommon.

Data input errors remain one of the ATSB’s top safety concerns for the travelling public.

Context

Flight crew

Captain

The captain had over 10,000 hours flying experience, including about 1,800 hours on the B737. The captain was free of duty for the two days prior to 1 August 2014. They reported their sleep as normal and did not report any fatigue-related concerns associated with the occurrence flight.

First officer

The first officer had over 10,000 hours flying experience, including about 7,000 hours on the B737. The first officer was also free of duty the two days prior to the occurrence flight. While the first officer reported their sleep was broken some of the nights leading up to the occurrence, they also reported their sleep the night prior as being ‘fine’ and that they felt normal on the day of the occurrence.

Meteorological information

Observations from the Sydney Airport automatic weather station were recorded every half hour. The surface weather conditions recorded at 1030 were a temperature of 19 °C, wind direction of 310 at 10 kt, QNH^[3] 1007 hPa, with no cloud below 5,000 ft and visibility greater than 10 km. There was a note on this observation that from 1030, there would be moderate to severe turbulence below 5,000 ft.

Aircraft information

Flight management system

The B737 has a flight management system which includes two flight management computers (FMC), which provide performance and flight path guidance to the crew, amongst other functions. During the pre-flight preparation, normally the first officer enters the aircraft’s zero fuel weight (ZFW) into the FMC. The FMC then adds the ZFW to the fuel on-board to calculate the take-off weight and Vref40 speed. The Vref40 speed is the reference speed for flaps 40 and is used to schedule flap retraction during the climb. This provides the mechanism for an independent check of the take-off weight.

After calculating the take-off speeds and thrust setting using the on-board performance calculation tool (OPT), the flight crew then enter these details into the FMC. The entered speeds and thrust setting are to be compared to the output from the OPT before being used for take-off.

Head-up guidance system

The B737 has a head-up guidance system (HGS) fitted on the captain’s side. The HGS overlays various flight parameters and navigation data over the captain’s outside view. This enables the captain to access, among other parameters, aircraft speed while maintaining their view of the runway.

During rotation, the aircraft tail strike pitch limit symbol will appear when the aircraft is approaching the tail strike angle. As well as the tail strike pitch limit indication, the aircraft reference symbol is also displayed and if the two symbols come in contact, a tail strike has probably occurred (Figure 1).

Figure 1: Tail strike pitch limit symbol (dumb bell) and aircraft reference symbol as displayed on the HGS

Source: Qantas Airways Ltd. (Qantas)

Operator information

On-board performance calculation tool

The flight crew used the on-board performance calculation tool (OPT) located on the company supplied iPad to calculate the take-off performance data. The OPT was developed by the aircraft manufacturer and was the same system the operator had used on the previous electronic flight bag laptop prior to the iPad. The crew reported their experience with using the OPT as being about 4 years on both the laptop and iPad.

The OPT has a data entry screen which allows the flight crew to select the appropriate airport, runway, conditions and configuration for take-off (Figure 2 – with take-off data used for the departure from Sydney). The OPT requires the selection of the aircraft registration prior to this point, to ensure the take-off data generated is accurate for that particular aircraft.

Figure 2: Take-off data entry screen in the on-board performance calculation tool for VHVZR showing the erroneous take-off weight (66,400 kg)

Source: Qantas

The OPT also gives a temperature (51 °C in Figure 2, above) to be entered in the FMC to reduce the take-off thrust from the engines. This allows the aircraft to use a lower engine setting (N1) for take-off, which improves engine reliability. The OPT takes into account the runway length and weight in determining this value to ensure the aircraft can take off within the runway distance available and maintain the required obstacle clearance during the subsequent climb.

Figure 3 shows the OPT data for the correct take-off weight of 76,400 kg. Of note is the difference in the take-off speeds, but also the temperature (51°C v 35°C). The lower temperature for the higher weight is indicative of the need for greater engine thrust for the take-off. This, in part, is due to the runway length and obstacle clearance requirements as noted above.

Figure 3: Take-off data entry screen in the on-board performance calculation tool for VHVZR showing the correct take-off weight (76,400 kg)

Source: Qantas

The OPT has numerous outputs that allow crew to send or view the take-off speeds and relevant information. One of these is the ‘bug card’, which displays the weight entered, the take-off speeds, flap setting and engine %N1 value (Figure 4). This feature presents this information in a similar format to the informal systems used by flight crew prior to the introduction of electronic flight bags. It also allows the crew to easily view all relevant information for take-off.

Figure 4: Bug card showing the correct take-off weight (76,400 kg) and speeds

Source: Qantas

Flight crew operations manual procedure

The flight crew operations manual (FCOM) procedure for initially calculating the take-off data in the OPT tells crew to use the take-off weight (TOW) from the provisional load sheet and add 500 kg. This addition of 500 kg is to allow for small last-minute changes to the final TOW, without the need for the crew to recalculate the take-off data unless the change is greater than 500 kg. This is a standard industry-wide technique adopted by operators to reduce the risk of errors during recalculation.

The procedure then calls for the crew to enter the ZFW into the FMC to calculate the TOW and Vref40. It is at this point that the take-off speeds are required to be verified, and the Vref40 speed is to be crosschecked between the FMC value and that previously calculated by the OPT. These values are required to match, with an allowable tolerance of +/- 1 kt to the Vref40 speed. Once the final load sheet is received, the crew then enter the revised ZFW and other data into the FMC.

If there are no significant changes between the provisional and final load sheets, then the crew are not required to revise the figures in the OPT based on the arrival of final load sheet. This is due to the fact that 500 kg was added to the provisional load sheet figures to allow for last minute changes. As there were no significant changes on the occurrence flight, there was not requirement to revisit the OPT at any stage prior to take-off. However, the purpose of the Vref40 check was to identify any discrepancy between two independently calculated TOWs in the OPT and FMC and despite the lack of changes to the load sheet, this check could still identify the error.

Related occurrences

ATSB investigation AO-2009-012^[4]

On the night of 20 March 2009, an Airbus 340-541, registered A6-ERG and operated by Emirates Airlines as flight EK407 sustained a tail strike and overran the runway on take-off from Melbourne Airport, Victoria. During the overrun, the aircraft struck a localiser antenna, damaging the antenna and part of the airframe. The tail strike resulted in significant damage to the tail of the aircraft.

The ATSB found that the accident resulted from the inadvertent use of erroneous take-off performance parameters, including speeds and thrust setting. Those erroneous parameters were the result of a take-off data entry error which resulted in the incorrect take-off weight being entered into the electronic flight bag during the pre-flight preparation.

In support of this investigation, the ATSB undertook a research study titled Take-off performance calculations and entry errors: A global perspective. This study reviewed the factors involved in a number of accidents and incidents in the 20 years leading to 2009. That report indicated that the accident involving A6-ERG was just one of many occurrences involving the use of erroneous take-off performance parameters across a range of aircraft types, operators, locations and types of operation.

ATSB investigation AO-2012-020^[5]

On 22 November 2011, during pre-flight performance calculations at Melbourne Airport, the crew of a Qantas B737-476 aircraft, registered VH-TJL, inadvertently used the full-length runway 16 distance to calculate the take-off performance figures despite planning a runway 16/taxiway Echo intersection departure. Neither crew identified the error, which produced inappropriately high take-off reference speeds. During the take-off run the crew realised there was inaccuracy in the figures and elected to continue the take-off, rotating the aircraft below the calculated rotation speed (VR).

The error was attributed to the Electronic Flight Bag (EFB) menu structure defaulting to the full runway length. As a result of this incident, Qantas advised that they have modified the EFB to require a positive selection of the runway length.

ATSB investigation AO-2013-195^[6]

On 14 October 2013, the crew of a Virgin Australia Airlines B737 aircraft, registered VH VUC, were preparing for a scheduled passenger service from Darwin, Northern Territory to Melbourne, Victoria.

In preparation for the flight, the first officer (FO) prepared two take-off data cards (TODCs), one for a runway 11 full length departure and another for an intersection departure from taxiway ‘Bravo 2’ (B2). The data for a full-length departure was entered into the flight management computer (FMC). Due to delays in using the full length of the runway, the crew elected to depart from the B2 intersection. The FO reprogrammed the FMC with the take-off performance data previously transcribed on the TODC for that departure and subsequently cross-checked by the captain.

After take-off, the crew noted that the TODC for the full runway length departure was visible on the centre pedestal, on top of the intersection departure TODC. The crew discussed whether the take-off from the B2 intersection was conducted based on the take-off performance data for a full runway length departure. While the crew were unable to determine what data was used, in the interests of safety, the event was reported.

The operator conducted an investigation into the incident and identified that the aircraft departed from the runway 11 B2 intersection using the take-off performance data for a full-length runway departure.

__________

3. Altimeter barometric pressure subscale setting to provide indication of height above mean sea level in that area.
4. ATSB investigation report AO-2009-012 Tailstrike and runway overrun involving Airbus A340-541, A6-ERG at Melbourne Airport, Victoria published 16 December 2011.
5. ATSB investigation report AO-2012-020 Pre-flight planning event involving Boeing 737-476, VH-TJL at Melbourne Airport, Victoria published 24 May 2012.
6. ATSB investigation report AO-2013-195 Pre-flight planning event involving a Boeing 737, VH-VUC at Darwin Airport published 17 June 2014.

Findings

From the evidence available, the following findings are made with respect to the data entry error and tail strike involving a Boeing 737-838, registered VH-VZR that occurred at Sydney Airport, New South Wales on 1 August 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• During the take-off, the aircraft was rotated at a speed about 10 kt lower than required for the aircraft's actual weight, which was sufficient to overpitch the aircraft, resulting in a tail strike.
• During the calculation of the take-off weight, both the captain and the first officer made independent inadvertent errors in their calculations, which resulted in the same, but incorrect, weight figure being used to calculate the take-off speeds.
• The Flight Crew Operating Manual procedure for crew comparison of the calculated Vref40 speed, while designed to assist in identifying a data entry error, could be misinterpreted, thereby negating the effectiveness of the check. [Safety issue]

Safety analysis

Introduction

Data entry errors when programming an electronic flight bag or flight management system are not uncommon (PARC/CAST Flight Deck Automation Working Group 2013). They are usually detected by the flight crew before there is any effect on the aircraft’s performance or flight path. On rare occasions, programming errors can lead to problems with the aircraft’s flight path or performance, and on very rare occasions contribute to aircraft accidents.

This analysis examines the various human performance factors identified during the investigation as having influenced the flight crew’s actions and ability to detect the erroneous data.

Data input error and error detection

There were two independent data entry errors related to this occurrence, which together negated the error check designed to catch a data input error. One involved the captain, who recorded the zero fuel weight (ZFW) and fuel load on a notepad in order to derive the take-off weight (TOW). It was during this calculation that the leading ‘1’ was dropped from the fuel figure, resulting in a TOW of 66,400 kg. This figure was then entered into the captain’s on-board performance tool (OPT) to derive the take-off speeds and engine setting.

The second error occurred when the first officer entered the take-off weight into their OPT. While the first officer reported correctly adding the ZFW and fuel figure to get a TOW of 76,400 kg, the weight entered into the OPT was 66,400 kg. This was likely the result of a transposition error when entering the figure into the OPT. A transposition error occurs when an individual inadvertently swaps two adjacent numbers or letters while speaking or writing down a value or word. In this case, it is likely the intended ‘7’ was entered as ‘6’. As the two derived TOW figures of 66,400 kg matched when the crew compared them, the error was not detected.

An observational study of airline operations examining error detection and recovery noted that ‘less than half the errors committed by crew were actually detected’ (Thomas, Petrilli and Dawson 2004). A number of factors may have increased the likelihood of the crew not detecting the error on this occasion.

As the OPT optimises engine performance for take-off, the speeds will vary for various runway length and weight configurations. This means it is possible to see the take-off speeds used during the occurrence, which were based on a TOW of 66,400 kg, for a TOW of 76,400 kg on a different runway. This makes it difficult for crew to develop a ‘rule of thumb’ or conduct a ‘sensibility’ check on the data as the same TOW will give varying speeds based on location and environmental conditions. As a result, the awareness of the crew in relation to an expected OPT output for a certain weight is not an effective defence for identifying a data entry error.

Additionally, the recent experience of the captain was such that a TOW around 66 T was not unusual and was consistent with recent sectors flown. As such, this figure alone was not enough to trigger the captain that there may have been a data entry or calculation error.

Flight crew operations manual procedure

The flight crew operations manual (FCOM) contained a procedure for conducting a check of the Vref40. This procedure called for the Vref40 speed to be ‘verified and compared’ but did not specify by which method this was to be done. This could lead to flight crew individually checking the figure instead of verbally checking it between them. On this occasion, the crew reported conducting an independent, individual check of this figure without discussing it.

The FCOM procedure for checking the Vref40 speed between the OPT and FMC calculated figures was to ensure that this figure was within +/- 1 kt. The captain reported that it was normal for crew to focus on the last digit of the Vref40 speed to ensure it was within this tolerance. In addition, on this flight, the captain had just set the V2 speed of ‘149’ on the mode control panel for indication on the primary flight display, before moving attention to the FMC for this check. The FMC was displaying the (correct) Vref40 figure of 149 kt, while the OPT calculated Vref40 speed was 139 kt. It is likely that the combination of verifying the last digit of the two figures, both of which were ‘9’ and the proximity of setting ‘149’ to checking ‘149’ negated the effectiveness of this check for the captain.

Expectancy is a factor which can influence how and where people look for information (Wickens and McCarley 2008). Expectancy can be influenced by such things as habit, salience, event rate (how often something occurs) and relevance, among other factors. The first officer reported conducting the Vref40 check and missing the difference between the OPT and FMC figures. Similarly to the captain, the first officer was also checking that the last digit was within tolerance as they had seen the figure vary by 2–3 kt previously and did not realise that a 10t change in weight would result in a 10 kt difference in the Vref40 speed. This focus on the last digit, combined with an expectation that any error would be apparent in the last digit, reduced the effectiveness of this check.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Flight crew operating manual procedure for Vref40 check

Proactive safety action taken by Qantas Airways Ltd. The Flight Crew Operating Manual procedure for crew comparison of the calculated Vref40 speed, while designed to assist in identifying a data entry error, could be misinterpreted, thereby negating the effectiveness of the check.

Safety Issue No: AO-2014-162-SI-01

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew of VZR
• Qantas Airways Ltd. (Qantas)
• the Civil Aviation Safety Authority (CASA).

References

Performance-based operations Aviation Rulemaking Committee/Commercial Aviation Safety Team Flight Deck Automation Working Group 2013, Operational use of flight path management systems. Available from www.faa.gov

Thomas, MJW, Petrilli, RM & Dawson, D 2004, ‘An exploratory study of error detection processes during normal flight operations’, Proceedings of the 26th conference of the European Association for Aviation Psychology, Lisbon, Portugal.

Wickens, CD, & McCarley, JS 2008, Applied attention theory. CRC Press, Boca Raton, FL, US.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew of VZR, Qantas, and CASA.

Submissions were received from the flight crew of VZR, Qantas and CASA. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

The occurrence

On 1 August 2014, at about 1034 Eastern Standard Time^[1] a Boeing 737-838 (B737) aircraft, registered VH-VZR (VZR) and operated by Qantas Airways Ltd. as flight QF842, commenced take-off from runway 34L at Sydney Airport, New South Wales. The flight was a scheduled passenger service from Sydney to Darwin, Northern Territory. The flight crew consisted of a captain, who was the pilot flying and a first officer, who was pilot monitoring.

The flight crew reported gusty conditions for take-off. During the take-off, the aircraft was rotated at the calculated rotation speed of 146 kt. After the aircraft had reached FL110, the crew turned off the seatbelt sign. At this stage, they received a call from the cabin crewmember seated in the rear galley, reporting that they had heard a ‘squeak’ during the rotation. The flight crew levelled VZR at FL280 to discuss the issue with the cabin crew and conduct the suspected tail strike checklist. The captain was referencing the head-up guidance system (HGS) during the take-off and recalled seeing the ‘dumb bell’ symbol appear (which is the tail strike pitch limit), however it did not appear to come into proximity of the aircraft reference symbol (which indicates the aircraft’s pitch).

After a discussion with the operator’s maintenance watch personnel, and given that the aircraft had pressurised normally and was not displaying any indications of a tail strike or associated damage, the decision was made to continue the flight to Darwin. The flight progressed normally and landed in Darwin at about 1423 Central Standard Time^[2].

After the passengers had disembarked, the captain conducted an inspection of the tail skid of VZR and noticed some paint damage and scrape marks, however the cartridge containing the sensor for a tail strike was still intact. This indicated that the tailskid had only just contacted the runway during the take-off. The captain phoned the operator’s duty captain to report the damage.

During a follow up phone call, the flight crew were asked to check the take-off performance figures calculated on their iPad and used to conduct the take-off in Sydney. During this check the first officer noted that the take-off weight entered into the on-board performance calculation tool on the iPad was incorrect and was 10 tonne lower than the actual take-off weight. The weight entered into the iPad tool was 66,400 kg instead of the actual weight of 76,400 kg. This resulted in the take-off speeds being calculated as V1 145 kt, VR 146 kt and V2 149 kt instead of V1 152 kt, VR 155 kt and V2 158 kt and a selected temperature of 51° instead of 35°. This reduced the take-off thrust setting from 93.1 per cent N1 RPM to 88.4 per cent. The lower speeds and higher temperature were subsequently entered into the aircraft’s flight management system and used for the take-off from Sydney.

__________

1. Eastern Standard Time was Coordinated Universal Time (UTC) + 10 hours.
2. Central Standard Time was Coordinated Universal Time (UTC) + 9.5 hours.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Preliminary report released 7 January 2015

This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

On the morning of 9 October 2014, a fire started in Ocean Drover’s crew accommodation while the livestock carrier was berthed in Fremantle and preparing to load cargo. The fire quickly spread, and the ship’s crew and a number of the port’s emergency response teams fought to control it for the rest of the day. Four of the ship’s crew sustained smoke inhalation requiring medical treatment; one being hospitalised for smoke inhalation and burns.

By the time the fire was extinguished the following day, the accommodation areas and the ship’s navigation bridge had been extensively damaged.

What the ATSB has found so far

Initial analysis by the ATSB and the Western Australia Department of Fire and Emergency Services (DFES) indicates that the fire started in one of the central forward cabins on the upper deck. The fire quickly spread and engulfed both the upper deck and the bridge deck above.

Investigation direction

The investigation is ongoing and will focus on:

• the circumstances and mechanisms of the fire initiation and spread
• the operation and efficacy of the ship’s fire detection, protection and extinguishing systems
• crew training and shipboard emergency response.

On 3 October 2014, at about 0900 Western Standard Time, a Jabiru J230 aircraft, registered 24-7491, departed Cape Leveque for Broome, Western Australia, with a pilot and one passenger on board. When at about 5 NM from Broome Airport, an air traffic controller cleared the aircraft to join a right circuit for runway 28. The pilot reported that the approach and landing were normal and the aircraft touched down on runway 28 just beyond the threshold.

During the landing roll, the pilot was focused on looking for the correct taxiway to exit the runway for the itinerant parking bay. The aircraft was decelerating normally and the pilot did not apply brakes due to the length of runway remaining. The pilot detected the right wing rising slightly, possibly due to a crosswind. He then looked straight ahead and realised that the aircraft had veered off the runway centreline to the left. He applied right rudder in an attempt to return to the centre of the runway, but the aircraft continued towards the edge of the runway and taxiway A. He sighted a grass area and a drainage ditch ahead just off the runway which he wanted to avoid, along with a Fokker 100 aircraft that was stationary on taxiway A at the holding point for runway 28. The pilot elected to apply full left rudder to turn the aircraft around and remain on the sealed area.

The Jabiru aircraft’s propeller and right wingtip struck the ground and the aircraft came to rest upright and facing in the opposite direction to the landing and about 20 m from the Fokker 100. The pilot and passenger were uninjured.

Aviaiton Short Investigations Bulletin - Issue 37